Information about the processing of personal data within the Clean Sport app

The Anti-Doping Committee of the Czech Republic, with its registered office at Za Císařským mlýnem 1063, 170 00 Prague 7 (hereinafter referred to as "ADV ČR"), as the controller of personal data, hereby informs, in accordance with Article 13 and Article 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as "GDPR"), about the processing of personal data within the Clean Sport application.

This document contains information about what personal data we process about data subjects, on what legal basis, for what purposes, to whom it may be transferred and what rights data subjects have in relation to the processing of personal data.

Data subjects and personal data processed

ADC CZ processes personal data of the following data subjects:

• users of the Clean Sport app

ADC CZ processes the following personal data of data subjects:

• identification data
• contact data
• other data contained in the message or suggestion sent, including health data you specify in the query

Purposes and Legal Basis for Processing

The purposes of processing personal data by ADC CZ are mainly:

• fulfillment of the contract according to Article 6(1)(b) GDPR, which means making the Clean Sport app available, ensuring its operation, and handling suggestions and messages
• providing responses to inquiries about medications based on consent according to Article 9(2)(a) GDPR

Method of Processing Personal Data of the Data Subject

ADC CZ rigorously protects personal data. Their processing is carried out in electronic information systems, which are subject to strict physical, technical, and procedural control. Processing may also be carried out manually. For the purpose of protecting personal data, ADC CZ has set up security mechanisms including technical, organizational, and personnel measures. ADC CZ does not use automated decision-making or profiling in the processing of personal data.

Recipients or Categories of Recipients of Personal Data

In some cases, ADC CZ may use the professional and specialized services of other entities, which usually act as processors and process personal data only based on instructions from ADC CZ. A data processing agreement is concluded with each such entity, in which the processor is obliged to protect and secure personal data. These processors do not process any personal data of data subjects for their own purposes. ADC CZ, in fulfilling its legal obligations, also transfers personal data to administrative bodies and authorities established by applicable legislation.

In some cases, personal data may also be transferred to recipients in countries outside the European Union and the European Economic Area. These countries may have different data protection laws and standards. Where no adequacy decision has been issued for these countries, ADV CR has taken appropriate measures to ensure that personal data is processed in accordance with the GDPR, for example by entering into standard contractual clauses issued by the European Commission.

Duration of Personal Data Storage

ADC CZ stores the personal data of data subjects processed for the stated purposes for a period of 5 years from the date of sending the suggestion or message or until the withdrawal of consent. In the event of the initiation of legal, administrative, or other proceedings, the personal data processed are kept for the entire duration of such proceedings.

Rights of Data Subjects Relating to the Protection of Personal Data

Based on the GDPR, data subjects have the following rights:

• The right to withdraw consent (Article 7 GDPR)
• The right of access to personal data (Article 15 GDPR)
• The right to rectification (Article 16 GDPR)
• The right to erasure (Article 17 GDPR)
• The right to restriction of processing (Article 18 GDPR)
• The right to data portability (Article 20 GDPR)
• The right to object to processing (Article 21 GDPR)
• The right to lodge a complaint with a supervisory authority (Article 77 GDPR)

Further information regarding the exercise of the above-described rights can be found in the document Personal Data Protection Principles.